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SECURE PARAMETER GENERATING DEVICE AND PARAMETER 
GENERATING METHOD IN ALGEBRAIC CURVE CRYPTOGRAPHY 



BACKGROUNDS OF THE INVENTION 
FIELD OF THE INVENTION 

The present invention relates to a secure 
parameter generating device, a generating method, and a 
storing medium in a discrete logarithm cryptography 
(hereinafter, referred to an algebraic curve 
cryptography), and more particularly to a secure 
parameter generating device and its generating method in 
a discrete logarithm cryptography using Jacobian group 
of algebraic curve . 

DESCRIPTION OF THE RELATED ART 

A discrete logarithm cryptography is a public 
key system based on the difficulty of a discrete 
logarithm problem on a given finite field. In order to 
keep the security of cryptography, the order of the 
finite field must be almost a prime number, that is, a 
factor of small integer and large integer. The algebraic 
curve cryptography that is one of the discrete logarithm 
cryptography needs to use an algebraic curve such that 
the order of the Jacobian group is almost a prime number. 

In the case of an elliptic curve that is the 
simplest algebraic curve, an efficient algorithm of 
calculating the order of the Jacobian group over any 
elliptic curve is known. The detailed description is 



shown in, for example, "Counting points on elliptic 
curves over finite fields", Journal de Theorie des 
Nombres, de Bordeaux 7 (1995), 219-254, Institue de 
Mathematique de Bordeaux, written by Rene Schoof. The 
elliptic curve such that the order of the Jacobian group 
is almost a prime factor can be obtained as follows, by 
using the above algorithm. 

1. Generate a random elliptic curve E. 

2. Calculate the order n of the Jacobian group 

of E. 

3. If n is almost a prime number, output E; 
otherwise, return to 1. 

In the case of an algebraic curve other than an 
elliptic curve, no efficient algorithm of calculating 
the order of the Jacobian group is known except for one 
hyper-elliptic curve. Therefore, the algebraic curve 
which can be used in the algebraic curve cryptography is 
limited to an elliptic curve or one exceptional hyper 
elliptic curve* 

As for the h-fold operation of the elements in 
the Jacobian group, "Software Installation of Discrete 
Logarithm Cryptography Using C ab curve" written by Arita, 
Yoshikawa, and Miyauchi, pp. 573-578, Security Symposium 
on Cryptography and Information in 1999, is known. 

Further, the technique disclosed in Japanese 
Patent Publication Laid-Open (Kokai) No. Heisei 6-282226 



comprises a step of selecting any prime number, storing 
an encryption key corresponding to the prime number into 
the public file device, generating a decoding key list 
corresponding to the prime number and the encryption key f 
and storing the decoding key list together with the 
prime number into a decoder, wherein an encoder obtains 
a public key of a receiver (decoder) from the public 
file, to multiply the plaintext on an elliptic curve, 
its value is sent to the decoder as a cryptogram, and 
the decoder computes a parameter of the elliptic curve 
from the cryptogram and selects a decoding key 
corresponding to the parameter by use of the decoding 
key list, thereby obtaining the plaintext from the value 
obtained by multiplying the cryptogram by the elliptic 
curve, using Chinese residue theorem. 

The above mentioned conventional technique 
limits the usable algebraic curves to an elliptic curve 
or one of exceptional hyper-elliptic curve. Since the 
elliptic curve and the hyper-elliptic curve are 
extremely particular algebraic curve from the viewpoint 
of the whole algebraic curves and this narrows the 
target for cryptanalysis, there arises a security 
problem of an algebraic curve cryptography. 

SUMMARY QF THE INVENTION 
An object of the present invention is to make it 
possible to use a higher and complicated algebraic curve 
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which couldn't be used, for an algebraic curve 
cryptography, and to provide a secure parameter 
generating device in an algebraic curve cryptography for 
improving the security of the algebraic curve 
5 cryptography . 

Further, another object of the present invention 
is to make it possible to use a higher and complicated 
algebraic curve which couldn't be used, for an algebraic 
curve cryptography, and to provide a secure parameter 
10 generating method in the algebraic cryptography for 

improving the security of the algebraic curve 
cryptography . 

According to the first aspect of the invention, 
a secure parameter generating device in an algebraic 
15 curve cryptography, comprises 

an input means for receiving two different prime 
numbers (a, b) specifying degree of complexity of a 
curve and size (n) of an encryption key to be used, 

a Stickelberger element computing device for 
20 computing a Stickelberger element ( co ) in an ab 

cyclotomic, based on the prime number (a) and the prime 
number ( b ) , 

a Jacobian addition candidate value computing 
device for computing Jacobian addition candidate value j 
25 corresponding to the two different prime numbers a and b, 

and a prime number p corresponding to the Jacobian 
addition candidate value j , based on the prime number 
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(a), the prime number (b), the size (n) of an encryption 

key, and the Stickelberger element (to) , 

an order candidate value computing device for 

computing a class H consisting of a plurality of 
5 candidate values for order of a Jacobian group of an 

algebraic curve specified by the prime number a and the 

prime number b, based on the prime number a, the prime 

number b, and the Jacobian addition candidate value j, 
a security judging device for searching for a 
10 candidate value h meeting a security condition such as 

almost prime number characteristic from the class H, 

according to the class H, 

a parameter deciding device for computing a 

parameter of an algebraic curve whose order of the 
15 Jacobian group is in accord with the candidate value h, 

of the algebraic curves specified by the prime number a, 

the prime number b, and the prime number p, based on the 

prime number a f the prime number b, the prime number p, 

and the candidate value h, and 
20 an output device for supplying the parameter of 

the algebraic curve computed by said parameter deciding 

device • 

In the preferred construction, a secure 
parameter generating device in an algebraic curve 
25 cryptography further comprises 

an a-storing means, a b-storing means, and an n- 
storing means for respectively storing the prime number 
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a, the prime number b, and the size n of the encryption 
key received by said input means, 

a co -storing means for storing a Stickelberger 
element co computed by said Stickelberger element 
5 computing device, 

a p-storing means and a j -storing means for 
respectively storing the prime number p and the Jacobian 
addition candidate value j computed by said Jacobian 
addition candidate value computing device, 
10 an H-storing means for storing the class H 

computed by said order candidate value computing device, 
and 

an h-storing means for storing the candidate 
value h found by said security judging device. 

15 In another preferred construction, a secure 

parameter generating device in an algebraic curve 
cryptography comprises 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 

20 equation 0) = S t [<t/a> + <t/b>] cr_{-t -1 } (where, t runs 

on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 

25 indicates Galois mapping £ — > in the ab cyclotomic 

(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b* 
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In another preferred construction, a secure 
parameter generating device in an algebraic curve 
cryptography comprises 

said Jacobian addition candidate value computing 
5 device for generating a at random, which is an algebraic 

integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
10 prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 60 ♦ 

In another preferred construction, a secure 
15 parameter generating device in an algebraic curve 

cryptography comprises 

said Stickelberger element computing device for 
computing the Stickelberger element CO by use of the 
equation co - S t [<t/a> + <t/b>] a^-t" 1 } (where, t runs 
20 on a typical series of irreducible residue class with ab 

used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping C £ * in the ab cyclotomic 
25 (C is the primitive ab root of 1)), based on the prime 

number a and the prime number b, and 

said Jacobian addition candidate value computing 
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device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
5 2n/ (a-1) (b-1) or so, based on the prime number a f the 

prime number b, the size n of the encryption key, 
and the Stickelberger element oo , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T w . 
□ 10 In another preferred construction, a secure 

yl parameter generating device in an algebraic curve 

\l] cryptography comprises 

[t| said order candidate value computing device for 

J computing a candidate value h k for the order of the 

15 Jacobian group of an algebraic curve specified by the 

rii 

parameters a and b, using the equation h k = Norm K)Q ( 1+ (- 
y C ) k j) (where Norm__{K|Q} is a norm mapping in the ab 

cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when Sis the primitive ab root of 1, 
20 based on the prime number a, the prime number b, and the 

Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h lf h 2 ,.*. ,h 2ab }. 

In another preferred construction, a secure 
parameter generating device in an algebraic curve 
25 cryptography comprises 

said Stickelberger element computing device for 
computing the Stickelberger element to by use of the 
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equation o> = S t [<t/a> + <t/b>] ^{-f 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
5 fractional portion A-[A] of the rational number A, o t 

indicates Galois mapping £ Z t in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b, and 

said order candidate value computing device for 
10 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K|Q ( 1+ (- 
C ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
15 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j, and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }. 

In another preferred construction, a secure 
20 parameter generating device in an algebraic curve 

cryptography comprises 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer r generating a prime ideal of a cyclotomic K 
25 generated by the primitive ab root of 1 and whose 

absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 



prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 00 , and 

said order candidate value computing device for 
computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K[Q ( 1+ (- 
C ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a f the prime number b, and the 
Jacobian addition candidate value j, and computing the 
class of the candidate values, H={h 1 ,h 2 , . . - ,h 2ab }. 

In another preferred construction, secure 
parameter generating device in an algebraic curve 
cryptography comprises 

said Stickelberger element computing device for 
computing the Stickelberger element to by use of the 
equation co = S t [<t/a> + <t/b>] <7_{-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A - [ A ] of the rational number A , a t 
indicates Galois mapping £ in the ab cyclotomic 

(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b, 



said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ (a-1) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element (x> , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 03 , and 

said order candidate value computing device for 
computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K | Q ( 1+ (- 
C ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j, and computing the 
class of the candidate values, H={h lf h 2 ,... ,h 2ab }. 

In another preferred construction, a secure 
parameter generating device in an algebraic curve 
cryptography comprises 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 



- 12 - 



p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
+ C b m X b +1=0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
5 computing the h-fold of an element in the Jacobian group 

indicated by the point G, and supplying p, £ a x , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 

10 a and the prime number b if the result is equal to an 

identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating device in an algebraic curve 
cryptography comprises 

15 said Stickelberger element computing device for 

computing the Stickelberger element co by use of the 
equation co = 2 t [<t/a> + <t/b>] a__{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 

20 exceeding a rational number A, <A> indicates a 

fractional portion A -[A] of the rational number A, cr t 
indicates Galois mapping £ — ► £ fc in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b, and 

25 said parameter deciding device for requiring the 

primitive a root £ a and the primitive b root S b of 1 
with the prime number p used as the divisor, based on 
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the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C a 1 Y a 
+ £ b m x b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, and £ b m 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating device in an algebraic curve 
cryptography comprises 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, and 
the Stickelberger element oo , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 0J , and 

said parameter deciding device for requiring the 
primitive a root C a and the primitive b root £ b of 1 
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with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation K> a L Y a 
5 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C/, and C b m 
as the parameter of an algebraic curve whose order of 

10 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group* 

In another preferred construction, a secure 

15 parameter generating device in an algebraic curve 

cryptography comprises 

said order candidate value computing device for 
computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 

20 parameters a and b, using the equation h k = Norm K)Q ( 1+ (- 

£ ) k j) (where Norm__{K| Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 

25 Jacobian addition candidate value j, and computing the 

class of the candidate values, H={h lf h 2f ... ,h 2ab }, and 

said parameter deciding device for requiring the 
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primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
5 G over an algebraic curve defined by the equation £ a x Y a 

+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively , 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £> a x r and K> h m 

10 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

15 In another preferred construction, a secure 

parameter generating device in an algebraic curve 
cryptography comprises 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 

20 equation co = E t [<t/a> + <t/b>] a_{-t _1 } (where, t runs 

on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A -[A] of the rational number A, o t 

25 indicates Galois mapping £ — » in the ab cyclotomic 

(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b, 



said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ (a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, and 
the Stickelberger element CO , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 03 , and 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a L Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a x , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating device in an algebraic curve 
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cryptography comprises 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = S t [<t/a> + <t/b>] cr_{-t -1 } (where, t runs 
5 on a typical series of irreducible residue class with ab 

used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ £ t in the ab cyclotomic 

10 is the primitive ab root of 1)), based on the prime 

number a and the prime number b, 

said order candidate value computing device for 
computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 

15 parameters a and b, using the equation h k = Norm K)Q ( 1+ (- 

£ ) k j) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 

20 Jacobian addition candidate value j, and computing the 

class of the candidate values, H={h 1/ h 2 ,... /h 2ab }, and 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 

25 the prime number a, the prime number b, the prime number 

p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C a 1 Y * 
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+ £ h m x b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and K> h m 
5 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

10 In another preferred construction, a secure 

parameter generating device in an algebraic curve 
cryptography comprises 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 

15 integer 7 generating a prime ideal of a cyclotomic K 

generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ ( a-1 ) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, and 

20 the Stickelberger element to , and computing the 

Jacobian addition candidate value j by use of the 
equation j = y 0J , 

said order candidate value computing device for 
computing a candidate value h k for the order of the 

25 Jacobian group of an algebraic curve specified by the 

parameters a and b, using the equation h k = Norm K(Q ( 1+ (- 
£ ) k j) (where Norm__{K|Q} is a norm mapping in the ab 
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cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
5 class of the candidate values, H={h 1/ h 2/ ... ,h 2ab }, and 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 

10 p, and the candidate value h, generating a random point 

G over an algebraic curve defined by the equation £ a 1 Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 

15 indicated by the point G, and supplying p, £ a x , and £ b m 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 

20 identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating device in an algebraic curve 
cryptography comprises 

said Stickelberger element computing device for 

25 computing the Stickelberger element 0) by use of the 

equation co = 2 t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
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used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ in the ab cyclotomic 

5 ( £ is the primitive ab root of 1)), based on the prime 

number a and the prime number b, 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
10 generated by the primitive ab root of 1 and whose 

absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, and 
the Stickelberger element co , and computing the 
15 Jacobian addition candidate value j by use of the 

equation j = 7 w f 

said order candidate value computing device for 
computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
20 parameters a and b, using the equation h k = Norm K(Q ( 1+ (- 

C ) k j) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
25 Jacobian addition candidate value j, and computing the 

class of the candidate values, H={h lf h 2 ,... ,h 2ab }, and 

said parameter deciding device for requiring the 
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primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b f the prime number 
p, and the candidate value h, generating a random point 
5 G over an algebraic curve defined by the equation C a x Y a 

+ £ b m x b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G f and supplying p, C^, and £ b m 

10 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

15 According to the second aspect of the invention, 

a secure parameter generating method in an algebraic 
curve, comprises the steps of 

a Stickelberger element computing procedure for 
computing a Stickelberger element co in an ab cyclotomic, 

20 respectively based on two different prime numbers a and 

b specifying degree of complexity of curve, 

a Jacobian addition candidate value computing 
procedure for computing Jacobian addition candidate 
value j corresponding to the two different prime numbers 

25 a and b, and a prime number p corresponding to the 

Jacobian addition candidate value j, respectively based 
on the prime number a, the prime number b, the size n of 
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an encryption key, and the Stickelberger element co , 

an order candidate value computing procedure for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
5 algebraic curve specified by the prime number a and the 

prime number b, respectively based on the prime number a, 
the prime number b, and the Jacobian addition candidate 
value j , 

a security judging procedure for searching for a 
10 candidate value h meeting a security condition such as 

almost prime number characteristic from the class H f 
according to the class H, and 

a parameter deciding procedure for computing a 
parameter of an algebraic curve whose order of the 
15 Jacobian group is in accord with the candidate value h f 

of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, respectively 
based on the prime number a, the prime number b, the 
prime number p, and the candidate value h. 
20 In the preferred construction, a secure 

parameter generating method in an algebraic curve 
cryptography comprises 

a procedure for storing a Stickelberger element 
0) computed by said Stickelberger element computing 
25 procedure into said co -storing means, 

a procedure for respectively storing the prime 
number p and the Jacobian addition candidate value j 
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computed by said Jacobian addition candidate value 
computing procedure into said p-storing means and j- 
storing means , 

a procedure for storing the class H computed by 
said order candidate value computing procedure into said 
H-storing means, and 

a procedure for storing the candidate value h 
found by said security judging procedure into said h- 
storing means . 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = S t [<t/a> + <t/b>] a^-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, o t 
indicates Galois mapping £ — ► £ * in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 



algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element to , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w . 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 
for computing the Stickelberger element to by use of the 
equation to = E t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ -» in the ab cyclotomic 

(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b, and 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
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the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 M . 

In another preferred construction , a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm KiQ ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation 0) = E t [<t/a> + <t/b>] a_{-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A - [ A ] of the rational number A , a t 
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indicates Galois mapping £ £ 11 in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b, and 

said order candidate value computing procedure 
5 for computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm KjQ ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 

10 to 2ab inclusively , when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1/ h 2r ... ,h 2ab }. 

In another preferred construction, a secure 

15 parameter generating method in an algebraic curve 

cryptography comprises 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer r generating a prime ideal of a 

20 cyclotomic K generated by the primitive ab root of 1 and 

whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element to , and computing the 

25 Jacobian addition candidate value j by use of the 

equation j = r w , and 

said order candidate value computing procedure 



for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm KjQ ( 1+ (- 
£ ) k j) (where Norm_{K| Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j, and computing the 
class of the candidate values, H={h lf h 2 ,... ,h 2ab }. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = E t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A -[A] of the rational number A, a t 
indicates Galois mapping £ — ► £ t in the ab cyclotomic 
(Z is the primitive ab root of 1)), based on the prime 
number a and the prime number b, 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
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length 2n/(a-l) (b-1) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
5 equation j = 7 " , and 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm KjQ ( 1+ (- 
!0 £ ) k j) (where Norm__{K|Q} is a norm mapping in the ab 

cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
15 class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said parameter deciding procedure for requiring 
20 the primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
25 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 



indicated by the point G, and supplying p, £ a x , and C b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

In another preferred construction , a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 
for computing the Stickelberger element CO by use of the 
equation to = 2 t [<t/a> + <t/b>] a__{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A -[A] of the rational number A, a t 
indicates Galois mapping £ — ► £ fc in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b, and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
+ £ b m X b +1 = 0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
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computing the h-folci of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a x , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
5 h, of the algebraic curves specified by the prime number 

a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 

10 cryptography comprises 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 

15 whose absolute norm becomes the prime number p of bit 

length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 

2 0 equation j = r w , and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 

25 p, and the candidate value h, generating a random point 

G over an algebraic curve defined by the equation £ a x Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 



- 31 - 



inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, and £ b m 

as the parameter of an algebraic curve whose order of 
5 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group* 

In another preferred construction, a secure 

10 parameter generating method in an algebraic curve 

cryptography comprises 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 

15 parameters a and b, using the equation h k = Norm KjQ ( 1+ (- 

C ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 

20 Jacobian addition candidate value j, and computing the 

class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }, and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 

25 the prime number a, the prime number b, the prime number 

p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation K> a 2 Y a 
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+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a x , and £ b m 
5 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

10 In another preferred construction, a secure 

parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 
for computing the Stickelberger element 0) by use of the 

15 equation co = S t [<t/a> + <t/b>] a__{-t -1 } (where, t runs 

on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 

20 indicates Galois mapping £ K> t in the ab cyclotomic 

(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b, 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 

25 algebraic integer r generating a prime ideal of a 

cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
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length 2n/ (a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element (o , and computing the 
Jacobian addition candidate value j by use of the 
5 equation j = T w , and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 

10 p, and the candidate value h, generating a random point 

G over an algebraic curve defined by the equation C a x Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 

15 indicated by the point G, and supplying p, £ ^ r and £ b m 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 

2 0 identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 

25 for computing the Stickelberger element co by use of the 

equation co = 2 t [<t/a> + <t/b>] a^-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
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used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, o t 
indicates Galois mapping £ £ fc in the ab cyclotomic 
5 is the primitive ab root of 1)), based on the prime 

number a and the prime number b, 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 

10 parameters a and b, using the equation h k - Norm KjQ ( 1+ (- 

£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 

15 Jacobian addition candidate value j , and computing the 

class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }, and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 

20 the prime number a, the prime number b, the prime number 

p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
+ C b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 

25 computing the h-fold of an element in the Jacobian group 

indicated by the point G, and supplying p, £ a x , and £ b m 
as the parameter of an algebraic curve whose order of 
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the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 
5 In another preferred construction , a secure 

parameter generating method in an algebraic curve 
cryptography comprises 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 

10 algebraic integer 7 generating a prime ideal of a 

cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 

15 and the Stickelberger element co , and computing the 

Jacobian addition candidate value j by use of the 
equation j = 7 w , 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 

20 Jacobian group of an algebraic curve specified by the 

parameters a and b, using the equation h k = Norm K(Q ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 

25 based on the prime number a, the prime number b, and the 

Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... /h 2ab }, and 
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said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
5 p, and the candidate value h, generating a random point 

G over an algebraic curve defined by the equation £ a x Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 

10 indicated by the point G, and supplying p, £ a 1 f and £ b m 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 

15 identity element in the Jacobian group. 

In another preferred construction, a secure 
parameter generating method in an algebraic curve 
cryptography comprises 

said Stickelberger element computing procedure 

2 0 for computing the Stickelberger element CO by use of the 

equation 0) = S t [<t/a> + <t/b>] c7_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

25 fractional portion A-[A] of the rational number A, a t 

indicates Galois mapping £ — * £ t in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 



number a and the prime number b f 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w , 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K j Q ( 1+ (- 
£ ) k j) (where Norm_{K|Q> is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1/ h 2 ,... ,h 2ab }, and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
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+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a x , and £ b m 
5 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

10 According to another aspect of the invention, a 

computer readable memory storing a program for 
generating a secure parameter in an algebraic curve 
cryptography, to run the program on a computer, 
the program comprises the steps of 

15 a Stickelberger element computing procedure for 

computing a Stickelberger element co in an ab cyclotomic, 
respectively based on two different prime numbers a and 
b specifying degree of complexity of curve, 

a Jacobian addition candidate value computing 

20 procedure for computing Jacobian addition candidate 

value j corresponding to the two different prime numbers 
a and b, and a prime number p corresponding to the 
Jacobian addition candidate value j , respectively based 
on the prime number a, the prime number b, the size n of 

25 an encryption key, and the Stickelberger element co , 

an order candidate value computing procedure for 
computing a class H consisting of a plurality of 



candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 
prime number b, respectively based on the prime number a, 
the prime number b, and the Jacobian addition candidate 
value j , 

a security judging procedure for searching for a 
candidate value h meeting a security condition such as 
almost prime number characteristic from the class H, 
according to the class H, and 

a parameter deciding procedure for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, respectively 
based on the prime number a, the prime number b, the 
prime number p, and the candidate value h. 

Other objects, features and advantages of the 
present invention will become clear from the detailed 
description given herebelow. 

BRIEF DESCRIPTION OF THE DRAWINGS 
The present invention will be understood more 
fully from the detailed description given herebelow and 
from the accompanying drawings of the preferred 
embodiment of the invention, which, however, should not 
be taken to be limitative to the invention, but are for 
explanation and understanding only* 
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In the drawings: 

Fig. 1 is a block diagram showing the form of 
the first embodiment according to the present invention; 

Fig. 2 is a flow chart showing the operation of 
5 a Stickelberger element computing device; 

Fig. 3 is a flow chart showing an operation of 
the Jacobian additive candidate value computing device; 

Fig. 4 is a flow chart showing the operation of 
the order candidate value computing device; 
10 Fig. 5 is a flow chart showing the parameter 

deciding device; 

Fig. 6 is a block diagram showing the form of 
the third embodiment of the present invention. 

15 DESCRIPTION OF THE PREFERRED EM BODIMENT 

The preferred embodiment of the present 
invention will be discussed hereinafter in detail with 
reference to the accompanying drawings. In the following 
description, numerous specific details are set forth in 

20 order to provide a thorough understanding of the present 

invention. It will be obvious, however, to those skilled 
in the art that the present invention may be practiced 
without these specific details. In other instance, well- 
known structures are not shown in detail in order to 

25 unnecessary obscure the present invention. 

First, the principle of the present invention 
will be described. 



The present invention is to efficiently search 
for an algebraic curve such that the order of the 
Jacobian group is almost a prime number , from the class 
of an algebraic curve having the definition expression 
such as QiY a +/3x b + 1 = 0, and to make it possible to use 
a higher and complicated algebraic curve that couldn't 
be used, for an algebraic curve cryptography. Here, the 
parameters a and b indicate the degree of complexity of 
curves. 

The algebraic curve over a finite field F q of the 
order q, which has the definition expression such as ct Y a 
+ /3x b + 1 = 0, is defined as C(q, a, j3 ) . As for the 
algebraic curve C(q, a , j3 ) , the order of the Jacobian 
group can be designed using the description about its L 
function by use of the Jacobian addition. 

Hereafter, for brief description, assume that 
q : = p (p is expressed by q) is a prime number, and that 
the expression, p = 1 mod LCM ( a , b) is satisfied (LCM is 
the least common multiple). Further, the primitive ab 
root of 1 is defined as C . The prime number p is 
completely factorized into m pieces of prime ideals, P x , 
p 2 , ... , P m in a cyclotomic Q( K> ) . Here, the number m is 
the number of irreducible residue classes of the divisor 
ab. 

The generator w of the multiplication group F p * 
of the finite field F p is fixed, and the index X s of F p * , 
as for the rational number such that (p-l)s becomes an 
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integer, is defined as X s (w) = exp(2 7ris) (where i is an 
imaginary number) . Assuming that X s (0) = 0 (s: when it 
is not an integer), =1 (s: when it is an integer), the 
domain is expanded on the whole F p . As for the integer 
1=1, 2, ... , a-1 and the integer m=l, 2, ... , b-1, the 
expression, j p (l, m) = E_{ l+ Vl +v 2 =0 } % 1/a ( Vl ) % m/b ( v 2 ) is 
called as Jacobian addition. Where, v 2 and v 2 run on v lf 
v 2 ^F p meeting the equation 1+Vi+v^O. At this time, it 
is well known that the L function L p (U) of C(p, a, 13) 
can be expressed by using the Jacobian addition as 
follows . 

L P (U) = n imlt 2 a _ lr m=lf 2 b _ x (i + % 1/a( or 1 ) % 

m/b(^ _1 ) j P (l/ m) U ). Therefore, the order h of the 
Jacobian group of C(p, a , /3 ) is given by h = L p (l) = n i=1 

2 a-l, ra=!, 2 b-1 ( 1 + X 1/a ( « ) X m/b ( )8 ) j p (l, m) )• It is 

necessary to calculate the Jacobian addition j p (l, m) , in 
order to require the order of the Jacobian group. 
However, since it is impossible to directly calculate 
the Jacobian addition j p (l, m) according to the 
definition expression, from the viewpoint of the volume 
of calculation, the Stickelberger element as for the 
following Jacobian addition is used. 

Assume that [ A ] indicates the maximum integer 
not exceeding the rational number A and that <A> 
indicates the fraction part A -[A] of the rational number 
A. Further, assume that a t indicates the Galois mapping 
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£ of the cyclotomic field Q(C). The Stickelberger 

element co(a, b) that is the generator of the group ring 
Z[Gal(Q(C)| Q) ] is defined as to (a, b) = E t [<t/a> + 
<t/b>] cr_ t " 1 . Where , t runs on the typical series of the 
5 irreducible residue class with the divisor ab. 

It is well known that the expression (j p (l/ m) ) - 
poxa, b> is sa tisfied as the ideal of the cyclotomic field 
Q( £ ) . Where, P is the prime ideal on p. By the above 
expression, j p (l, m) is necessarily resolved except for 
10 the 2ab root of 1. Of the results, the degree of freedom 

for ab root can be obtained by the degree of freedom of 
the coefficient a, J3 e F q of C(p, a, j8 ) . 

In these ways, the search algorithm of the 
following secure curve C(p, a, /3 ) can be obtained. 
15 The search algorithm of the secure curve C(p, Of, j3 ) 

input: the number of Jacobian bits n 
output: p, ot , jS 

(1) g <- <a-l)(b-l)/2 

(2) The candidate j of the Jacobian addition as for the 
20 prime number p of some n/g bit or the like is searched 

for by using the calculation algorithm of the candidate 
value of the Jacobian addition as described later: 
(P/ j) {calculation algorithm of the candidate value 
of the Jacobian addition} ( n/g) . 
25 (3) as for the respective k = 0, 1, ... , ab, 

K ^n 1=lf 2 a _ lr mmlt 2 b-1 ( i + (-£ >* j) 

(4) Check whether there is an almost prime number h k in 



- 44 - 



{ h 0/ h lf ... , h ab }. If there is none, return to (1). If 
there is, h := h k is defined. 

(5) The symbols £ a , £ b are respectively defined as a- 
root of 1 and b-root of 1 in F p . Check whether the order 
5 of the Jacobian group of the curve C(p, Sb* 1 ):^ 1 y a 

+ £ b m x b + 1 = 0 is equal to h, as for the respective 1 = 
0, 1, ... , a-1 and the respective m = 0, 1, ... , b-1. 
If it is equal, output p, « = C a 1 , £ = £ b n and finish the 
operation. If such 1 and m don't exist, return to (2). 

10 In the calculation algorithm of the candidate 

value of the Jacobian addition used in the above, the 
candidate value of the Jacobian addition is required by 
using the above-mentioned Stickelberger element co(a, b) 
= E t [<t/a> + <t/b>] a.t" 1 - 

15 The calculation algorithm of the candidate value of the 

Jacobian addition is as follows, 
input: the number of bits m, 
output: p, j, 

(1) co <- S t (<t/a> + <t/b>)a„ t " 1 , 
20 (2) Generate r 0 = S^" 1 c x £ 1 ( -10 < c x < 10 ) at random. 

(3) as for the respective i = 1, 2, ... , 

r <- r 0 + i, 

p <- Nornfe (C) | Q ( 7 ), 
Is p smaller than m bit or so? 
25 yes — » continue, 

Is p larger than m bit or so? 
yes ^ to (2) , 



Is p a prime number? 
no — ► continue , 

(4) Output j <- r w , p and j , and finish. 

This time, the form of the first embodiment of 
the present invention will be described with reference 
to the accompanying drawings. Fig. 1 is a block diagram 
showing the form of the first embodiment. 

With reference to Fig. 1, the form of the first 
embodiment of the present invention comprises a 
Stickelberger element computing device 11, a Jacobian 
addition candidate value computing device 12, an order 
candidate value computing device 13, a security judging 
device 14, a parameter deciding device 15, a memory 16, 
an input device 17, an output device 18, and a central 
processing unit 19. 

The memory 16 includes a a-storing file 161, a 
b-storing file 162, a co-storing file 163, a j-storing 
file 164, an H-storing file 165, an h-storing file 166, 
a p-storing file 167, and an n-storing file 168. 

Hereinafter, assume that a known method is used 
for the norm arithmetic N Q(CH Q and four fundamental 
arithmetic rules of algebraic number in the cyclotomic 
field Q{ C ) , arithmetic of the function of the Galois 
group G(Q(C)| Q) for the cyclotomic field Q( £ ) , and 
addition and multiplication in the group ring Z[G(Q(£)| 
Q) ] on the Galois group G(Q( £ ) | Q) of the integer ring Z 
coefficient. 



The operation of the form of a first embodiment 
according to the present invention will be described 
this time. 

Fig. 2 is a flow chart showing the operation of 
the Stickelberger element computing device 11. Fig. 3 is 
a flow chart showing the operation of the Jacobian 
addition candidate value computing device 12. Fig. 4 is 
a flow chart showing the operation of the order 
candidate value computing device 13. Fig. 5 is a flow 
chart showing the operation of the parameter deciding 
device 15. 

The description will be made in the case where 
two different prime numbers, a=3, b=7 , specifying the 
degree of complexity of a curve, and the size n=160 of 
an encryption key to be used are supplied from the input 
device 17. The supplied a and b are temporarily stored 
in the a-storing file 161 and the b-storing file 162 
respectively, through the central processing unit 19. 
Further, a variable found in the following description 
is stored in the memory 16. 

The Stickelberger element computing device 11 
obtains a=3, b=7 from the a-storing file 161 and the fa- 
storing file 162, according to the operation as shown in 
Fig. 2, and operates as follows. 

A typical series {1, 2, 4, 5, 8, 10, 11, 13, 16, 
17, 19, 20} of the irreducible residue class with a-b = 
3X7=21 used for the variable L as the divisor is stored 
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in Step S21 of Fig. 2. 

As for the respective integers t included in the 
variable L={1, 2, 4, 5, 8, 10, 11, 13, 16, 17, 19, 20} 
in Step 22 of Fig. 2, for example, as for t=l, since 
5 [<l/3>+<l/7>] = [l/3+l/7]=[10/21]=0, 0 is stored in the 

variable m; since -l" 1 = -1 = 20 mod 21, 20 is stored in 
the variable s; since 0Xa 20 = 0, 0 is stored in the 
variable A x . 

As for the other t, since 
10 [<2/3>+<2/7>]=[2/3+2/7]=[20/21]=0, 0 is stored in the 

variableA 2 ; since [<4/3>+<4/7>]=[ 1/3+4/7 ]=[ 19/21 ]=0 , 0 
is stored in the variable A 4 ; since 

[<5/3>+<5/7>]=[2/3+5/7]=[29/21]=l and (-5)" 1 = 16" 1 = 4 
mod 21, a 4 is stored in the variable A 5 ; since 
15 [<8/3>+<8/7>]=[2/3+l/7]=[17/21]=0, 0 is stored in the 

variable A 8 ; since [<10/3>+<10/7>]=[ 1/3+3/7 ] = [ 16/21]=0, 0 
is stored in the variable A 10 ; since 

[<ll/3>+<ll/7>] = [2/3+4/7] = [26/21] = l and (-11) -1 = 10" 1 = 
19 mod 21, a 19 is stored in the variable A 21 ; since 

20 [<13/3>+<13/7>] = [l/3+6/7] = [25/21] = l and (-13)' 1 = 8" 1 = 

8mod 21, o 8 is stored in the variable A 13 ; since 
[<16/3>+<16/7>]=[l/3+2/7]=[13/21]=0, 0 is stored in the 
variableA 16 ; since [<17/3>+<17/7>]=[2/3+3/7]-[23/21]=l 
and (-17)" 1 = 4" 1 = 16 mod 21, o 16 is stored in the 

25 variable A 17 ; since [<19/3>+<19/7>] =[ 1/3+5/7 ]=[ 22/21 ]=1 

and (-19) -1 = 2" 1 = 11 mod 21, a n is stored in the 
variable A 19 ; and since 
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[<20/3>+<20/7>]=[2/3+6/7]=[32/21]=l and (-20)" 1 = l" 1 = 1 
mod 21 f 0 1 is stored in the variable A 20 , in the same way, 



The totals = a 4 + a 19 + a 8 + a 16 + a n + a x of 
5 the whole data stored in the respective variables A lf A 2 , 

A 4 , A 5 , A a , A 10 , A llf A 13 , A 16 , A 17f A 19 , A 20 is computed 
in Step S23 of Fig. 2. Here, the total means the total 
in the group ring Z [G(Q( £ ) | Q) 1 r indicating the total 
of the coefficients of the respective a L with the 

10 respective a L regarded as symbols. The arithmetic result 

co is temporarily stored in the co -storing file 163 
through the central processing unit 19. 

The Jacobian addition candidate value computing 
device 12 obtains a=3, b=7, n=160, co = a 4 + a 19 + a 8 + a 16 

15 + a n + a 1 from the a-storing file 161, the b-storing 

file 162, the n-storing file 168, and the co-storing file 
163 and computes the candidate value j of the Jacobian 
addition, according to the processing as shown in Fig. 3, 
as follows. 

20 Since ab=21, the primitive 21 st power root of 1 

is stored in the variable £, and since 2n / (a-l)(b-l) = 
2 6.6... , 27 is stored in the variable m, in Step 31 of 
Fig. 3. 

The random integer of the cyclotomic field Q( £ ) 
25 is stored in the variable 7 0 as follow, in Step S32 of 

Fig. 3. The variable 7 0 is initialized to 0; the random 
number r 0 = -2 is generated as for t=0, r 0 £ 0 = -2 is 
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added to 7 0 , so to require 7 0 =-2; the random number r x = 
2 is generated as for t=l, r l K> 1 = 2 £ is added to r 0 / 
so to require r 0 = -2 + 2£ ; and the same operation is 
repeated until t=ll, so to require 7 0 = -2 + 2£-£ 2 + 2£ 
5 3 + 2£ 5 -£ 6 -£ 7 -2£ 8 + 2£ 9 -C 11 , in Step S32 of Fig. 

3. 

The following operation will be performed on the 
respective integers i=0, 1, 2, ... , in Step S33 of Fig. 
3. As for i=0, 7 0 + 0 is stored in the variable 7, so 

10 to obtain 7=-2 + 2£-£ 2 + 2£ 3 + 2£ 5 -£ 6 -£ 7 -2C 8 

+ 2£ 9 - C 11 , to compute the norm N Q(C)|Q (7). The 
resultant 129571513 is stored in the p-storing file 167 , 
the number of bits 29 of p = 129571513 is stored in the 
variable 1. That 1=29 and m=27 or so is confirmed. When 

15 p = 129571513 is factorized into prime factors in the 

known way, p = 129571513 = 43 X 211 X 14281 is obtained. 
Since p = 129571513 is not a prime number, the operation 
as for i = 0 is finished, and as for i = 1, the same 
operation will be repeated. In the form of this 

2 0 embodiment, the same operation is continued until i = 2. 

As for i = 2, T 0 + 2 is stored in the variable 7, so to 
obtain 7 = 2£-£ 2 + 2£ 3 + 2£ 5 -£ 6 -£ 7 -2£ 8 + 2£ 9 -£ 

11 ,to compute the norm N Q(C)|Q (7). The resultant 
163255597 is stored in the p-storing file 167, and the 
25 number of bits 28 of p = 163255597 is stored in the 

variable 1. Since 1=28 and m=27 or so, and p = 163255597 
is determined as a prime number (a known method is used 
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for judgment of a prime number), the operation of Step 
S33 will be finished. 

In Step S34 of Fig. 3, the Stickelberger element 
co=a 4 + a 19 + a 8 + a 16 + a u + a L is adopted to work on 
5 the value 2 £ - £ 2 + 2 £ 3 + 2 £ 5 - £ 6 - £ 7 - 2 £ 8 + 2 £ 9 - £ 11 

of the variable 7 and the result is stored in the j- 
storing file 164. 

Namely, since j = a 4 ( r ) a 19 ( r ) o 8 ( r ) o 16 ( r ) a 
nCncMT) = -11346 + 4158 S + 9337 £ 2 - 10930 C 3 + 3060 C 
10 4 + 11132 £ 5 - 1408 C 6 - 10000 £ 7 + 7506 C 8 + 1237 C 9 - 9894 

£ 10 + 16406 C 11 , the content of the j-storing file 164 
becomes -11346 + 4158 £ + 9337 £ 2 - 10930 £ 3 + 3060 £ 4 + 
11132C 5 - 1408 C 6 - 10000 S 7 + 7506 C 8 + 1237 C 9 - 9894 £ 10 
+ 16406 C 11 . 

15 The order candidate value computing device 13 

obtains a, b, j respectively from the a-storing file 16 1, 
the b-storing file 162, and the j-storing file 164, 
according to the processing as shown in Fig. 4, and 
computes each candidate value for the order of the 

20 Jacobian group, as follows. 

Since ab=21, the primitive 21 st power root of 1 
is stored in the variable C, in Step S41 of Fig. 4. 

in Step S42 of Fig. 4, N Q(C) , Q (1 + <-£) k j) is 
computed as for the respective integers k=l, ... , 2ab=42, 

25 by using the Jacobian addition candidate value j, and 

the result is stored in the variable h k . Namely, since 
N Q(0| q (1 + <-£ ) j) 
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=18945750554224674862720917379214050968749547249577 as 
for k=l, 

18945750554224674862720917379214050968749547249577 is 
stored in the variable h lf and since N Q(C)! Q (1 + (-S ) 2 j) 
5 = 18928969305265796978830941938772180777050417721949 as 

for k=2, 

189289693052 65796978830941938772180777050417721949 is 
stored in the variable h 2 . 



10 Hereinafter, in the same way, 

18939442397757559639176586128404383479076142135761 is 
stored in the variable h 3 ; 

189350603454064372 47984249590121980321244862496761 is 
stored in the variable h 4 ; 
15 189356226768527266849 02 816970612470237474541809664 is 

stored in the variable h 5 ; 

1893193690366570547558164730557444478626323706 9081 is 
stored in the variable h 6 ; 

189295606547718601013 83318185997674116929 626012 889 is 
2 0 stored in the variable h 7 ; 

1893915020365025018616631524212 6355786799280592469 is 
stored in the variable h 8 ; 

189326758072 73674693936115572103379669380378369473 is 
stored in the variable h 9 ; 
25 18942309965821405414970614992239749691042375170033 is 

stored in the variable h 10 ; 

18934229290635176830764035532046510839791719442389 is 
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stored in the variable h n ; 

1893583417258860302 65 088075149616536034319682 93369 is 
stored in the variable h 12 ; 

18938078743053945947831932134835899678969080710281 is 
5 stored in the variable h 13 ; 

18930980854114698521197692341107826796840225368461 is 
stored in the variable h 14 ; 

189259263484821260467 97408190951930473609373791353 is 
stored in the variable h 15 ; 
10 1893622972431433832 7608155999193464492 913218459633 is 

stored in the variable h 16 ; 

189353890982784874952 05740285052812170943878823253 is 
stored in the variable h 17 ; 

18931691567781542 998050896522571358027374445665073 is 
15 stored in the variable h 18 ; 

18932734180610926108166703609049207716180145717849 is 
stored in the variable h 19 ; 

18938664411743724815803784593761801461579705647693 is 
stored in the variable h 20 ; 
20 1893394275277010517 9837989473472080616474423254969 is 

stored in the variable h 21 ; 

1891930298633577 7367049540268484273861903106390769 is 
stored in the variable h 22 ; 

189360753968852 70373781711765180522497408613713621 is 
25 stored in the variable h 23 ; 

18925604328984592 62 9627465194343191206594160037073 is 
stored in the variable h 24 ; 
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189299848637 88418751836156261712299372083231633577 is 
stored in the variable h 25 ; 

1892 942253179364817011122 8339741198150094983499776 is 
stored in the variable h 26 ; 

189331079545415288651528488040626727531664484607 61 is 
stored in the variable h 27 ; 

189354836347 054870530435635943910482 99333735703993 is 
stored in the variable h 23 ; 

1892589684834006285197213669678334822112 7455098349 is 
stored in the variable h 29 ; 

18932368490475205159124453933007681555744 68632 6777 is 
stored in the variable h 30 ; 

18922739336864448742 750281538719599103232 717642873 is 
stored in the variable h 31 ; 

1893081517521734482 660949237518 6423724694014551957 is 
stored in the variable h 32 ; 

1892 9210510360406226057659372472230885175421077009 is 
stored in the variable h 33 ; 

1892696732 7936730178250537884862137815188718140673 is 
stored in the variable h 34 ; 

189340637632 7212 6450623787600233843527396400812437 is 
stored in the variable h 35 ; 

1893912 05597 618768010542 925068817008 854152 87701041 is 
stored in the variable h 36 ; 

18928816315710623530089460607608797337081800632473 is 
stored in the variable h 37 ; 

18929656538570982 720438072 809652072203857571941789 is 
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10 



stored in the variable h 38 ; 

18933352 9338 62176606331230531189579186007983024249 is 
stored in the variable h 39 ; 

189323106632 74994445599743180032 079937147687805121 is 
stored in the variable h 40 ; 

1892 6381945702726406182 624557022344113037957991709 is 
stored in the variable h 41 ; and 

18931102681789095072229676262975577344314266433617 is 
stored in the variable h 42 , respectively. 



Finally, the order candidate value computing 
device 13 combines the contents of the variables h x to h 42 
together as H and stores the same into the H-storing 
file 165. 

15 The security judging device 14 obtains the H 

from the H-storing file 165, and searches for a 
candidate value h meeting the security condition of 
almost prime number characteristic from the order 
candidate values h ir h 2 , ... , h 42 included in the H, and 

20 stores the same into the h-storing file 166. In this 

form of the embodiment, for brief description, the 
security condition is considered as for the almost prime 
number characteristic. By use of the known prime number 
judging method, h u = 

25 1893422 92906351768307 64035532 046510839791719442389 is 

judged to be a prime number, and the security judging 
device 14 stores h - h L1 = 
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18934229290635176830764035532046510839791719442389 into 
the h-storing file 166, 

The parameter deciding device 15 obtains a f b, p f 
and h respectively from the a-storing file 161, the b- 
5 storing file 162, the p-storing file 167, and the h- 

storing file 166, and operates according to the 
processing as shown in Fig. 5. 

In Step S51 of Fig. 5, 127994587 that is the 
primitive 3 rd power root of 1 with p = 16325559 7 used as 
P 10 the divisor is stored in the variable £ 3 , and 8342648 

PI that is the primitive 7 th power root of 1 with p = 

Lfi 163255597 used as the divisor is stored in the variable 

fc; 15 In Step S52 of Fig. 5, the following processing 

|f will be performed on the respective integers 1=1, 2, 3 

*f and the respective integers m=l, 2, 3, 4, 5, 6, 7. 

When 1=1 and m=l, £ 3 = 127994587 is stored in 
20 the variable £ , and £ 7 = 8342648 is stored in the 

variable 7] . The random element {151707017 + 104678491 x 
+ 123646083 x 2 + 18753988 y + 87634493 x 3 + 61274336 x y 
+ x 4 , 138799785 + 145105684 x + 584395 x 2 + 80828873 y + 
34715892 x 3 + 121885874 x y + 59787844 x 4 + x 2 y, 
25 161162224 + 117150097 x + 100956100 x 2 + 89380061 y + 

140032555 x 3 + 43367019 x y + y 2 } of the Jacobian group 
of an algebraic curve defined by the expression e y 3 + 77 
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x 7 + 1 = 127994587 y 3 + 8342648 x 7 + 1 = 0 is generated, 
and this is stored in the variable G, the power of 
h=1893422929063517 68307640355320465 108397 9 17 19442389 in 
the Jacobian group, on a point stored in the variable G 
5 is computed, and the result {133659497 + 103424746 x + 

136032897 x 2 + 131029199 y + 24618867 x 3 + 114944034 x y 
+ x 4 , 86125426 + 125891893 x + 19568269 x 2 + 27044314 y + 
80420960 x 3 + 137562092 x y + x 2 y, 53604112 + 65990501 x 
+ 51269221 x 2 + 55271502 y + 7974233 x 3 + 84922220 x y + 

10 y 2 } is stored in the variable G. 

Since the above content of the variable G is not 
equal to the identity element {} in the Jacobian group, £ 
3 = 127994587 is stored in the variable £, and £ 7 2 = 
8342648 2 mod 163255597 = 159772073 is stored in the 

15 variable 77, as for 1=1 and m = 2, thereby repeating 

the above processing. 

In the case of the form of this embodiment, when 
1 =2 and m=2, s = 35261009 and 7} = 159772073 are 
obtained, the power of 

2 0 h=189342292 9 06351768307640355320465 108397 9 17 19442389 on 

the point G = {4568071 + 141843715 x + 68256743 x 2 + 
71903501 y + 128953783 x 3 + 10781960 x y + x 4 , 48272788 + 
45615229 x + 150692034 x 2 + 53973350 y + 11114765 x 3 + 
78550130 x y + 61331354 x 4 + x 2 y, 117552807 + 135448907 

25 x + 64074711 x 2 + 141058974 y + 49208246 x 3 + 93940317 x 

y 4- y 2 } generated at random results in the identity 
element {}, and the parameter deciding device 15 
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supplies p=163255597, £=35261009, 77=159772073 as the 
parameters of a secure algebraic curve. 

Finally, the parameters p=163255597, £=35261009, 
7} =159772073 supplied by the parameter deciding device 15 
5 are supplied from the output device 18. 

This time, the form of a second embodiment 
according to the present invention will be described in 
detail . 

The form of the second embodiment according to 
10 the present invention is a secure parameter generating 

method in an algebraic curve cryptography, comprising: 

(a) a Stickelberger element computing procedure of 
requiring the prime numbers a and b respectively from 
-the a-storing file 161 and the b-storing file 162 and 

15 computing the Stickelberger element co in the ab portion 

of the cyclotomic field; 

(b) a procedure of storing the Stickelberger element co 
computed in the above Stickelberger element computing 
procedure into the co -storing file 163; 

2 0 (c) a Jacobian addition candidate value computing 

procedure of requiring the prime number a, the prime 
number b, the size n of an encryption key, and the 
Stickelberger element co respectively from the a-storing 
file 161, the b-storing file 162, the n-storing file 168, 

25 and co -storing file 163 and computing the Jacobian 

addition candidate value j as for the two different 
prime numbers a and b and the prime number p 



corresponding to the Jacobian addition candidate value 

j; 

(d) a procedure of storing the prime number p and the 
Jacobian addition candidate value j computed in the 
above Jacobian addition candidate value computing 
procedure, respectively into the p-storing file 167 and 
the j-storing file 164; 

(e) an order candidate value computing procedure of 
requiring the prime number a, the prime number b, and 
the Jacobian candidate value j respectively from the a- 
storing file 161, the b-storing file 162, and the j- 
storing file 164 and computing the class H consisting of 
a plurality of candidate values for the order of the 
Jacobian group of the algebraic curve specified by the 
prime number a and the prime number b; 

(f) a procedure of storing the class H computed in the 
above order candidate value computing procedure into the 
H-storing file 165; 

(g) a security judging procedure of requiring the class 
H from the H-storing file 165 and searching for the 
candidate value h meeting the security condition such as 
almost prime number characteristic; 

(h) a procedure of storing the candidate value h found 
in the above security judging procedure, into the h- 
storing file 166; and 

(i) a parameter deciding procedure of requiring the 
prime number a, the prime number b, the prime number p, 
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and the candidate value h respectively from the a- 
storing file 161, the b-storing file 162 , the p-storing 
file 167 , and the h-storing file 166 and computing a 
parameter of an algebraic curve whose order of the 
5 Jacobian group is in accord with the candidate value h, 

of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p. 

The form of a third embodiment according to the 
present invention will be described in detail with 

10 reference to the drawings, this time. Fig. 6 is a block 

diagram showing the form of the third embodiment 
according to the present invention. 

With reference to Fig. 6, the form of the third 
embodiment of the present invention is a storing medium 

15 130 for storing a program for running the respective 

procedures according to the form of the second 
embodiment of the present invention, on a computer 100. 
This program is executed after being loaded in a storage 
of the computer 100. 

20 The present invention is effective in enabling 

the use of a higher and complicated algebraic curve 
which couldn't be used, for an algebraic curve 
cryptography, and improving the security of the 
algebraic curve cryptography. This is because an 

25 algebraic curve having a prime number substantially as 

the order of the Jacobian group can be found efficiently 
from the class of algebraic curves having the following 
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definition equation; a Y a +/3x b + 1 = 0, thereby expanding 
the range of the usable algebraic curves and dispersedly 
increasing the decoding work of a hacker. 

Although the invention has been illustrated and 
5 described with respect to exemplary embodiment thereof, 

it should be understood by those skilled in the art that 
the foregoing and various other changes, omissions and 
additions may be made therein and thereto, without 
departing from the spirit and scope of the present 

10 invention. Therefore, the present invention should not 

be understood as limited to the specific embodiment set 
out above but to include all possible embodiments which 
can be embodies within a scope encompassed and 
equivalents thereof with respect to the feature set out 

15 in the appended claims. 



WHAT IS fIT.ATMED IS; 

A secure parameter generating device in an 
algebraic curve cryptography , comprising: 

an input means for receiving two different prime 
numbers (a, b) specifying degree of complexity of a 
curve and size (n) of an encryption key to be used; 

a Stickelberger element computing device for 
computing a Stickelberger element ( 0) ) in an ab 
cyclotomic, based on the prime number (a) and the prime 
number (b); 

a Jacobian addition candidate value computing 
device for computing Jacobian addition candidate value j 
corresponding to the two different prime numbers a and b, 
and a prime number p corresponding to the Jacobian 
addition candidate value j , based on the prime number 
(a), the prime number (b), the size (n) of an encryption 
key, and the Stickelberger element (to) ; 

an order candidate value computing device for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 
prime number b, based on the prime number a, the prime 
number b, and the Jacobian addition candidate value j; 

a security judging device for searching for a 
candidate value h meeting a security condition such as 
almost prime number characteristic from the class H, 



according to the class H; 

a parameter deciding device for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, based on the 
prime number a, the prime number b, the prime number p, 
and the candidate value h; and 

an output device for supplying the parameter of 
the algebraic curve computed by said parameter deciding 
device . 

2 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

an a-storing means, a b-storing means, and an n- 
storing means for respectively storing the prime number 
a, the prime number b, and the size n of the encryption 
key received by said input means; 

a co —storing means for storing a Stickelberger 
element 0) computed by said Stickelberger element 
computing device; 

a p-storing means and a j -storing means for 
respectively storing the prime number p and the Jacobian 
addition candidate value j computed by said Jacobian 
addition candidate value computing device; 

an H-storing means for storing the class H 
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computed by said order candidate value computing device; 
and 

an h-storing means for storing the candidate 
value h found by said security judging device. 

3. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = 2 t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor , [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ — ► in the ab cyclotomic 

(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b. 

4 • A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
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2n/(a-l) (b-1) or so, based on the prime number a, the 
10 prime number b, the size n of the encryption key f 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 " . 



5* A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
5 computing the Stickelberger element co by use of the 

equation co = S t [<t/a> + <t/b>] a__{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A -[A] of the rational number A, a t 

indicates Galois mapping K> -* £ * in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said Jacobian addition candidate value computing 

15 device for generating a; at random, which is an algebraic 

integer r generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 

20 prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
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Jacobian addition candidate value j by use of the 
equation j = 7 w . 

6 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said order candidate value computing device for 
5 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K[Q ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
10 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h lf h 2/ ... ,h 2ab }. 



7 • A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
5 computing the Stickelberger element co by use of the 

equation co = E t [<t/a> + <t/b>] a__{-t~ 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
10 fractional portion A-[A] of the rational number A, a t 
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indicates Galois mapping £ £ * in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said order candidate value computing device for 

15 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K]Q ( 1+ (- 
K> ) k j) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 

20 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values , H={h lf h 2f ... , h 2ab }* 

8 • A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Jacobian addition candidate value computing 
5 device for generating a at random, which is an algebraic 

integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
10 prime number b, the size n of the encryption key, 

and the Stickelberger element 0) , and computing the 
Jacobian addition candidate value j by use of the 
equation j = y °* ; and 
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said order candidate value computing device for 
15 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K j Q ( 1+ (- 
£ ) k j) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
20 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H-{h lf h 2 ,... ,h 2ab }. 



9 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
5 computing the Stickelberger element co by use of the 

equation co = E t [<t/a> + <t/b>] cr_{-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A -[A] of the rational number A, O t 

indicates Galois mapping £ — * £ t in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 

15 device for generating ot at random, which is an algebraic 

integer 7 generating a prime ideal of a cyclotomic K 
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generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ (a-1 ) (b-1 ) or so, based on the prime number a, the 

20 prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w ; and 

said order candidate value computing device for 

25 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K | Q ( 1+ (- 
C ) k j) (where Norm_{K| Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 

30 to 2ab inclusively, when£is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }„ 



10. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said parameter deciding device for requiring the 
5 primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 



+ C b m X b + 1 = 0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, and £ h m 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

11. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = S t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ in the ab cyclotomic 

(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root C b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 



p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a L Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

12 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element 0) , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T w ; and 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root K> b of 1 



with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C a x Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and C b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group • 

13. a secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said order candidate value computing device for 
computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K , Q ( 1+ (- 
£ ) k j) (where Norm_{K| Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, whenCis the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2/ ... ,h 2ab }; and 
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said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

14. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation 0) = S t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ £ in the ab cyclotomic 



(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w ; and 

said parameter deciding device for requiring the 
primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p f and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 
+ £ b m X b +1 = 0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a 1 , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 
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15 ♦ A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
5 computing the Stickelberger element CO by use of the 

equation co = S t [<t/a> + <t/b>] o _{-t~ 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A-[A] of the rational number A, a t 

indicates Galois mapping £ £ * in the ab cyclotomic 
( £ is the primitive ab root of 1 ) ) , based on the prime 
number a and the prime number b; 

said order candidate value computing device for 

15 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K j Q ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 

20 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 17 h 2 ,... ,h 2ab }; and 

said parameter deciding device for requiring the 

25 primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
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the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ ^ Y a 

30 + t b m x b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, K> * , and K> b m 
as the parameter of an algebraic curve whose order of 

35 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



16. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Jacobian addition candidate value computing 
5 device for generating Of at random, which is an algebraic 

integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, the 
10 prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 0> ; 

said order candidate value computing device for 
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15 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b r using the equation h k = Norm K[Q ( 1+ (- 
K> ) k j) (where Norm__{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 

20 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 17 h 2/ ... /h 2ab }; and 

said parameter deciding device for requiring the 

25 primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 

30 + £ b m x b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and £ b m 
as the parameter of an algebraic curve whose order of 

35 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



17 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
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further comprising: 

said Stickelberger element computing device for 
5 computing the Stickelberger element co by use of the 

equation co = 2 t [<t/a> + <t/b>] a^-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A -[A] of the rational number A, a t 

indicates Galois mapping £ — » £ t in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 

15 device for generating a at random, which is an algebraic 

integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l ) (b-1) or so, based on the prime number a, the 

20 prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w ; 

said order candidate value computing device for 

25 computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K | Q ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
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30 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2/ ... , h 2ab }; and 

said parameter deciding device for requiring the 

35 primitive a root £ a and the primitive b root K> b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C a x Y a 

40 + C h m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C a 1 r and £ b m 
as the parameter of an algebraic curve whose order of 

45 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 




1JK A secure parameter generating method in an 

algebraic curve, comprising the steps of: 

a Stickelberger element computing procedure for 
computing a Stickelberger element co in an ab cyclotomic, 
respectively based on two different prime numbers a and 
b specifying degree of complexity of curve; 

a Jacobian addition candidate value computing 



procedure for computing Jacobian addition candidate 
value j corresponding to the two different prime numbers 
a and b, and a prime number p corresponding to the 
Jacobian addition candidate value j , respectively based 
on the prime number a, the prime number b, the size n of 
an encryption key, and the Stickelberger element co ; 

an order candidate value computing procedure for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 
prime number b, respectively based on the prime number a, 
the prime number b, and the Jacobian addition candidate 
value j ; 

a security judging procedure for searching for a 
candidate value h meeting a security condition such as 
almost prime number characteristic from the class H, 
according to the class H; and 

a parameter deciding procedure for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, respectively 
based on the prime number a, the prime number b, the 
prime number p, and the candidate value h. 

19. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
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further comprising: 

a procedure for storing a Stickelberger element 
5 co computed by said Stickelberger element computing 

procedure into said a) -storing means; 

a procedure for respectively storing the prime 
number p and the Jacobian addition candidate value j 
computed by said Jacobian addition candidate value 
10 computing procedure into said p-storing means and j- 

storing means; 

a procedure for storing the class H computed by 
said order candidate value computing procedure into said 
H-storing means; and 
15 a procedure for storing the candidate value h 

found by said security judging procedure into said h- 
storing means . 



20. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element to by use of the 

equation oo = E t [<t/a> + <t/b>] CF _{-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
10 fractional portion A -[A] of the rational number A, a t 

indicates Galois mapping £ — * C t in the ab cyclotomic 
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( C is the primitive ab root of 1 ) ) , based on the prime 
number a and the prime number b. 

21. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Jacobian addition candidate value computing 
5 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ (a-1) (b-1 ) or so, based on the prime number a, 
10 the prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w . 

22. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element co by use of the 

equation co = S t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
10 fractional portion A -[A] of the rational number A, a t 
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indicates Galois mapping £ in the ab cyclotomic 

(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said Jacobian addition candidate value computing 
15 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 

□ 20 the prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 

^ Jacobian addition candidate value j by use of the 

%l equation j = 7 " . 

P 23. A secure parameter generating method in an 

PI! algebraic curve cryptography as claimed in Claim 18, 

y ! 

O further comprising: 

said order candidate value computing procedure 
5 for computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K|Q ( 1+ (- 
£ ) k j) (where Norrti_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
10 to 2ab inclusively, when C is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }. 
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24. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18 , 
further comprising: 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = S t [<t/a> + <t/b>] a_{-f x > (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number a, <A> indicates a 
fractional portion A-[A] of the rational number A, a t 
indicates Galois mapping £ -> £ * in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K[Q (l+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }. 

25. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
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further comprising: 

said Jacobian addition candidate value computing 
5 procedure for generating a at random f which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1) or so, based on the prime number a, 

10 the prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w ; and 

said order candidate value computing procedure 

15 for computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K(p ( 1+ (- 
£ ) k j) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 

20 to 2ab inclusively, when Sis the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h lf h 2/ . . . , h 2ab }. 



26. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element co by use of the 
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equation co = St [<t/a> + <t/b>] a_{-t-l} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A-[A] of the rational number A f a t 

indicates Galois mapping £ — * £ fc in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 

15 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/(a-l) (b-1) or so, based on the prime number a, 

20 the prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T w ; and 

said order candidate value computing procedure 

25 for computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm^t 1+ (- 
C ) k j) (where Norm_{K|Q> is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 

30 to 2ab inclusively, when Sis the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j, and computing the 
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class of the candidate values, H={h 1 ,h 2/ ... ,h 2ab }. 



27. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said parameter deciding procedure for requiring 
5 the primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a * Y a 

10 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a x , and £ b m 
as the parameter of an algebraic curve whose order of 

15 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



28. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element 0) by use of the 

equation co = E t [<t/a> + <t/b>] c_{-t -1 } (where, t runs 
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on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A-[A] of the rational number A, a t 

indicates Galois mapping £ £ t in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said parameter deciding procedure for requiring 

15 the primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 

20 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a 2 , and £ b m 
as the parameter of an algebraic curve whose order of 

25 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group, 

29. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Jacobian addition candidate value computing 
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5 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 

10 the prime number b, the size n of the encryption key, 

and the Stickelberger element (D , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 03 ; and 

said parameter deciding procedure for requiring 

15 the primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 

20 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and £ b ra 
as the parameter of an algebraic curve whose order of 

25 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



30. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
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further comprising: 

said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K}Q ( 1+ (- 
£ ) k j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }; and 

said parameter deciding procedure for requiring 
the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a L Y a 
+ £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and £ b m 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 
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31. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element co by use of the 

equation co = 2 t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A -[A] of the rational number A, a t 

indicates Galois mapping £ — ► £ * in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 

15 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ (a-1 ) (b-1 ) or so, based on the prime number a, 

20 the prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 03 ; and 

said parameter deciding procedure for requiring 

25 the primitive a root £ a and the primitive b root C b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
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p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a x Y a 

30 + C b m X fa + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C/, and £ b m 
as the parameter of an algebraic curve whose order of 

35 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



32. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element co by use of the 

equation CO = S t [<t/a> + <t/b>] ^^{-t" 1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A -[A] of the rational number A, a t 

indicates Galois mapping £ — * in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said order candidate value computing procedure 

15 for computing a candidate value h k for the order of the 
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Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K{Q ( 1+ (- 
C) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 

20 to 2ab inclusively, when C is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h lf h 2/ ..* f h 2ab }; and 

said parameter deciding procedure for requiring 

25 the primitive a root £ a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h f generating a random point 
G over an algebraic curve defined by the equation £ a l Y a 

30 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C/, and £ b m 
as the parameter of an algebraic curve whose order of 

35 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group* 



33. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 
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said Jacobian addition candidate value computing 
5 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 

10 the prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 60 ; 

said order candidate value computing procedure 

15 for computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b f using the equation h k = Norm K | Q ( 1+ (- 
£ ) k j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 

20 to 2ab inclusively, when £ is the primitive ab root of l f 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2/ ... ,h 2ab }; and 

said parameter deciding procedure for requiring 

25 the primitive a root C a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ a L Y a 

30 + £ b m X b + 1 = 0 , as for each integer 1 from 1 to a 
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inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ a L , and £ b m 
as the parameter of an algebraic curve whose order of 
35 the Jacobian group is in accord with the candidate value 

h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group ♦ 



34. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18 , 
further comprising: 

said Stickelberger element computing procedure 
5 for computing the Stickelberger element co by use of the 

equation co = 2 t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 

10 fractional portion A-[A] of the rational number A, cr t 

indicates Galois mapping £ — * £ t in the ab cyclotomic 
(£ is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 

15 procedure for generating a at random, which is an 

algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
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length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 

20 the prime number b, the size n of the encryption key, 

and the Stickelberger element to , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 03 ; 

said order candidate value computing procedure 

25 for computing a candidate value h k for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K|Q ( 1+ (- 
C ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 

30 to 2ab inclusively, when £ is the primitive ab root of 1, 

based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={h 1 ,h 2 ,... ,h 2ab }; and 

said parameter deciding procedure for requiring 

35 the primitive a root C a and the primitive b root £ b of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation £ ^ Y a 

40 + £ b m x b + 1 = 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, £ ^ , and £ h ™ 
as the parameter of an algebraic curve whose order of 

45 the Jacobian group is in accord with the candidate value 
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h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 




35r. A computer readable memory storing a program for 

generating a secure parameter in an algebraic curve 
cryptography, to run the program on a computer, 
the program comprising the steps of: 
5 a Stickelberger element computing procedure for 

computing a Stickelberger element co in an ab cyclotomic, 
respectively based on two different prime numbers a and 
b specifying degree of complexity of curve; 

a Jacobian addition candidate value computing 

10 procedure for computing Jacobian addition candidate 

value j corresponding to the two different prime numbers 
a and b, and a prime number p corresponding to the 
Jacobian addition candidate value j , respectively based 
on the prime number a, the prime number b, the size n of 

15 an encryption key, and the Stickelberger element co ; 

an order candidate value computing procedure for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 

20 prime number b, respectively based on the prime number a, 

the prime number b, and the Jacobian addition candidate 
value j ; 

a security judging procedure for searching for a 
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candidate value h meeting a security condition such as 
25 almost prime number characteristic from the class H, 

according to the class H; and 

a parameter deciding procedure for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
30 of the algebraic curves specified by the prime number a, 

the prime number b, and the prime number p, respectively 
based on the prime number a, the prime number b, the 
prime number p, and the candidate value h. 

3^ A computer readable memory storing a program for 
generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
5 said Stickelberger element computing procedure 

for computing the Stickelberger element co by use of the 
equation co = E t [<t/a> + <t/b>] a_{-t -1 } (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
10 exceeding a rational number A, <A> indicates a 

fractional portion A -[A] of the rational number A, a t 
indicates Galois mapping £ — ► C fc in the ab cyclotomic 
( £ is the primitive ab root of 1 ) ) , based on the prime 
number a and the prime number b . 



15 



A computer readable memory storing a program for 



- 98 - 



generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b f the size n of the encryption key, 
and the Stickelberger element to f and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 w . 

A computer readable memory storing a program for 
generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
said order candidate value computing procedure 
for computing a candidate value h k for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h k = Norm K(Q ( 1+ (- 
£ ) k j) (where Norm_{K | Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 



- 99 - 



class of the candidate values, H={h lf h 2f ... ,h 2ab }. 

15 

39. A computer readable memory storing a program for 

/ 

generating a secure parameter in an algebraic curve 
c r y p t o g r aphy , 

the program comprising the steps of: 
5 said parameter deciding procedure for requiring 

the primitive a root £ a and the primitive b root £ b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 

10 G over an algebraic curve defined by the equation C a : Y * 

+ £ b m X b +1 = 0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Z,^, and £ b m 

15 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 
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AB STRACT OF THE DIS CL OS URE 
The Stickelberger element computing device 
computes a Stickelberger element to in an ab cyclotomic; 
the Jacobian addition candidate value computing device 
computes the Jacobian addition candidate value j and a 
prime number p corresponding to the Jacobian addition 
candidate value j , based on the prime number a, the 
prime number b, the size n of an encryption key, and the 
Stickelberger element CO; the order candidate value 
computing device computes a class H consisting of a 
plurality of candidate values for the order of the 
Jacobian group of an algebraic curve, based on the prime 
number a, the prime number b, and the Jacobian addition 
candidate value j ; the security judging device searches 
for a candidate value h meeting a security condition 
such as almost prime number characteristic from the 
class H; and the parameter deciding device computes a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p. 
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FIG. 3 
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FIG. 5 
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DocKet No. 



DECLARATION AND POWER OF ATTORNEY 



As a below named inventor, I hereby declare that: 

My residence, post office address and citizenship are as stated below next to my name. 

I believe [ am the original, first and sole inventor (if only one name is listed below) or an original, first and joint inventor (if plura! names are 
listed below) of the subject matter which is claimed and tor which a patent is sought on the invention entitled: 

SECURE PARAMETER GENERATING DEVICE AND PARAMETER GENERATING METHOD IN 
the specification of which is attached hereto unless the following box is checked; ALGEBRAIC CURVE CRYPTOGRAPHY 

was tiled on . as United States Application Number or PCT International Application 

Number and was amended on ^ (if applicable). 

I hereby state that I have reviewed and understand the contents of the above-identified specification, including the claims, as amended by any 
amendment referred to above. 

I acknowledge the duty to disclose information which is known by me to be material to patentability as defined in Title 37, Code of Federal 
Regulations § 1.56. 

I hereby claim foreign priority benefits under Title 35, United States Code, § U9(a)-(d) or § 365(b) of any foreign application(s) tor patent 
or inventor's certificate, or § 365(a) of any PCT International application which designated at least one country other than the United States, 
listed below and have also identified below any foreign application- for patent or inventor's certificate, or PCT International application having 
a filing date before that of the application on which priority is claimed: 

PRIOR FOREIGN APPLICATION(S) 



NUMBER 


COUNTRY 


DAY/MONTH/ YEAR FILED 


PRIORITY 
CLAIMED 


11-242075 


Japan 


27/August/1999 


Yes 



































I hereby claim the benefit under Title 35, United States Code § 119(e) of any United States provisional application(s) listed below. 



APPLICATION NO. 


FILING DATE 























I hereby claim the benefit under Title 35, United States Code, § 120 of any United States application(s), or § 365(c) of any PCT International 
application designating the United States, listed below and, insofar as the subject matter of each of the claims of this application is not disclosed 
in the prior United States or PCT International application in the manner provided by the first paragraph of Title 35, United States Code, § 
1 12, 1 acknowledge the duty to disclose information which is known by me to be material to patentability as defined in Title 37. Code of Federal 
Regulations § 1 .56 which became available between the filing date of the prior application and the national or PCT International filing date 
of this application: 



APPLICATION SERIAL NO. 


FILING DATE 


STATUS; PATENTED, PENDING, 
ABANDONED 

































I hereby appoint as my attorneys, with full powers of substitution and revocation, to prosecute this application and transact all business m the 
Patent and Trademark Office connected therewith: Stephen A. Bent, Reg. No. 29,768; David A. Blumenthal. Reg. No. 26,257; John J. 
Feldhaus, Reg. No. 28,822; Donald D. Jeffery, Reg. No. 19,980; Eugene M. Lee, Reg. No. 32,039; Peter G. Mack, Reg. No. 26.001: 
Brian J. McNamara, Reg. No. 32,789; Sybil Meloy, Reg. No. 22,749; George E. Quillin, Reg. No. 32,792; Colin G. Sandercock, Reg. No. 
31,298; Bernhard D. Saxe, Reg. No. 28.665; Charles F. Schill, Reg. No. 27,590; Richard L. Schwaab, Reg. No. 25,479; Arthur Schwartz, 
Reg. No. 22,115; Harold C. Wegner, Reg. No. 25,258. 



r/\vjc i UocKet iNo. 

'* 

Address all correspondence to FOLEY & LARDNER. Washington Harbour, 3000 K Street. N.W., Suite 500, P.O. Box 25696. Washington. 
D,C. 20007-8696\ Address telephone communications to David A. Blumenthal at (202) 672-5300. 

I hereby declare that all statements made herein of my own knowledge are true and that all statements made on information and belief are 
believed to be true; and further that these statements were made with the knowledge that wiiltul false statements and the like so made are 
punishable by fine or imprisonment, or both, under Section 1001 of Title 18 of the United States Code and that such willful false statements 
may jeopardize the validity of the application or any patent issued thereon. 



Full Name of First or Sole Inventor 
Seigo ARITA 


Signature of First or Sole Inventor 


Date 
Ajg.14,2000 


Residence Address U 
Tokyo, Japan 


Country of Citizenship 
Japan 


Post Office Address 

c/o NEC Corporation, 7-1, Shiba 5-chcme, Minato-ku, Tokyo, Japan 



Full Name of Second Inventor 


Signature of Second Inventor 


Date 


Residence Address 


Country of Citizenship 


, Post Office Address ■ 



*i' Full Name of Third Inventor 


Signature of Third Inventor 


Date 


)\ Residence Address 


Country of Citizenship 


Post Office Address 




J Full Name of Fourth Inventor 


Signature of Fourth Inventor 


Date 


Residence Address 


Country of Citizenship 


Post Office Address 



Full Name of Fifth Inventor 


Signature of Fifth Inventor 


Date 


Residence Address 


Country of Citizenship 


Post Office Address 



